Privacy Policy

Last updated: [9th Dec 2025

This Privacy Policy explains how South West Care Homes Ltd (“we”, “us”, “our”) collects, uses and protects your personal information when you:

• visit our main website: [main domain, e.g. southwestcarehomes.co.uk];

• visit any of our individual care home websites (each a “Home Website”);

• contact us by phone, email, post or social media;

• enquire about or use our care services;

• apply for a job with us; or

• otherwise interact with us.

We are committed to protecting your privacy and handling your information fairly, lawfully and transparently, in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

This Privacy Policy should be read alongside our Cookie Policy, which explains how we use cookies and similar technologies on our websites.

---

1. Who we are

For most activities described in this Privacy Policy, the data controller is:

South West Care Homes Ltd
Tamar Science Park, 1 Davy Road, Plymouth PL6 8BX
Email: info@southwestcarehomes.co.uk
Telephone: 0800 324 7007

Each individual care home may operate under a different trading name (for example, “[Home Name] Care Home”) but will be part of, or managed on behalf of, South West Care Homes Ltd.

Where a particular home is operated by a different legal entity, that entity may also be a data controller for the services it provides. In such cases, this will be clearly identified in resident contracts and local information.

Our websites are designed, developed and/or managed by:

SW1 Limited
(Website design, development and management services)

SW1 Limited acts as our data processor in relation to website hosting, maintenance and certain online forms, processing personal data on our behalf and under our instructions.

---

2. What personal data we collect

The information we collect depends on how you interact with us. We may collect the following categories of personal data.

2.1 Information you provide directly

You may give us information when you:

• complete an enquiry form on a Home Website;

• contact us by phone, email, post or social media;

• request a brochure or further information;

• visit one of our homes;

• apply for a job or provide services to us;

• enter into a contract with us for care services.

This can include:

• Identification and contact details
  Name, title, postal address, email address, telephone number, relationship to the person you are contacting us about (for example self, family member, professional referrer).

• Enquiry details
  Information about care needs, preferences, budgets, availability, and any other details you choose to provide.

• Resident and prospective resident information

  • Date of birth, gender, NHS number;

  • Next of kin, family and legal representative details;

  • Funding and financial information (e.g. private funding, local authority or NHS funding, guarantor details);

  • Health and care information, such as medical history, diagnoses, medications, allergies, mobility and dietary needs, care plans, incident records and related information;

  • Safeguarding and risk information relevant to the safe provision of care;

  • Lifestyle and preference information (e.g. interests, routines, religious or cultural preferences).

• Job applicant and staff information

  • CVs, application forms, interview notes;

  • Identification, right to work and vetting information (including DBS checks where required);

  • Employment records, training and qualification records, absence information, performance reviews;

  • Payroll and benefits information (e.g. bank details, NI number, pension details).

• Supplier & contractor information
  Contact details, professional information, contractual and payment details.

Some of this information will be special category data (for example, health information) or, in limited cases, data relating to criminal convictions (for example, during vetting checks for staff). These are given additional protection under data protection law (see section 4).

2.2 Information we collect automatically (website use)

When you visit our websites, we may automatically collect certain technical and usage information, for example:

• IP address, browser type and version, device identifiers, operating system and platform;

• time zone setting and approximate location (country/region);

• pages you visit, time spent on each page, navigation paths and links clicked;

• information collected through cookies and similar technologies.

We use cookies for purposes including basic site functionality, security, accessibility, remembering preferences, and (with consent) analytics. Our sites use the Accessibility Helper plugin to support visitors who wish to adjust font size, contrast, colour schemes and similar visual settings; this uses cookies to remember your choices.

Full details are provided in our Cookie Policy.

2.3 Information from third parties

We may receive information about you from third parties, including:

• health and social care professionals involved in your care (e.g. GPs, hospitals, social workers, community nurses);

• local authorities, NHS bodies or other funding organisations;

• previous care providers or support services (with appropriate authority or consent);

• recruitment agencies and background check providers (e.g. DBS checks);

• your family members or representatives, where they provide information on your behalf.

Where we receive information from third parties, we treat it in accordance with this Privacy Policy and any relevant legal requirements.

---

3. Why we use your personal data (purposes)

We use your personal data for the following purposes:

• To operate and manage our websites
  Including providing access to pages, maintaining security and improving performance and content.

• To respond to enquiries
  Handling contact and enquiry forms, telephone calls, emails, letters and other communications about our services.

• To assess suitability for admission
  Evaluating care needs and service suitability for prospective residents.

• To provide care and support services
  Planning, delivering and reviewing care, maintaining care records, communicating with residents, families and professionals, and ensuring safety and quality.

• To manage contracts and billing
  Preparing and administering care agreements, invoicing, managing payments and dealing with queries or disputes.

• To meet legal and regulatory obligations
  Complying with health and social care regulations, safeguarding requirements, health and safety obligations, tax and accounting rules, and responding to regulatory or legal requests (e.g. from the CQC or local authorities).

• To manage recruitment, HR and payroll
  Processing job applications, administering employment contracts, managing performance and training, maintaining staff records and paying salaries.

• To manage suppliers and contractors
  Managing relationships, contracts and payments with suppliers and contractors.

• To monitor and improve our services
  Analysing website use (where permitted), reviewing feedback and incidents, and improving the quality, safety and experience of our care and services.

• For security and fraud prevention
  Protecting our residents, staff, visitors, systems and property.

• To send permitted marketing and information
  Providing news and updates about our homes and services, where lawful and in line with your preferences (see section 11).

We do not undertake automated decision-making that produces legal or similarly significant effects on individuals, without human involvement.

---

4. Our legal bases for processing

We only process personal data when we have a lawful basis under UK GDPR. Depending on the situation, we may rely on:

4.1 Performance of a contract

Processing that is necessary:

• to enter into a contract with you (for example, assessing a care placement for you or a family member); or

• to perform a contract we have entered into (for example, providing care services or employment).

4.2 Legal obligation

Processing that is necessary to comply with our legal obligations, such as:

• health and social care regulations;

• safeguarding, health and safety and public health obligations;

• tax and accounting requirements;

• employment and immigration law;

• responding to lawful requests from regulators or public authorities.

4.3 Vital interests

Processing that is necessary to protect someone’s life or prevent serious harm, for example sharing critical medical information with emergency services in urgent situations.

4.4 Legitimate interests

Processing that is necessary for our legitimate interests or those of a third party, provided that your interests and fundamental rights do not override those interests, for example:

• managing and improving our services and websites;

• responding to enquiries and complaints;

• maintaining security and preventing fraud;

• keeping records of communications and interactions;

• internal governance, reporting and business operations.

Where we rely on legitimate interests, we consider and balance any potential impact on you.

4.5 Consent

We may rely on your consent when:

• using certain optional cookies and similar technologies (e.g. Google Analytics) that are not strictly necessary, in line with PECR;

• sending certain types of direct marketing communications where consent is required;

• processing specific types of data not covered by other legal bases.

Where we rely on consent, you can withdraw it at any time. This will not affect the lawfulness of processing carried out before consent is withdrawn.

4.6 Special category and criminal offence data

Special category data (such as health information or religious beliefs) and any limited criminal offence data (e.g. DBS checks) are processed under additional conditions in UK GDPR Article 9 and Schedule 1 of the Data Protection Act 2018, including:

• the provision of health or social care;

• employment and social security;

• substantial public interest (for example safeguarding);

• explicit consent (in specific cases).

We only process this type of data where it is strictly necessary and with appropriate safeguards in place.

---

5. Sharing your personal data

We may share your personal data with:

• Health and social care professionals involved in your care, such as GPs, hospitals, therapists, social workers and other community services.

• Local authorities, NHS bodies and regulators, such as the Care Quality Commission (CQC), where required for funding, regulation, safeguarding or public health purposes.

• Family members, legal representatives and attorneys, where necessary and appropriate for your care, and in line with your wishes and legal authority.

• Professional advisers, such as lawyers, accountants, auditors and insurers.

• Service providers and suppliers who process data on our behalf, including:

  • website design, hosting and maintenance providers (including SW1 Limited);

  • IT support and software providers;

  • telecoms, printing and mailing services;

  • payment processors and banks;

  • recruitment and HR service providers;

  • training and e-learning providers.

• Regulatory and law enforcement authorities, where required by law or in connection with safeguarding concerns, suspected fraud or other legal matters.

Where we use third-party service providers, we require them to:

• only process your data on our instructions;

• keep it secure; and

• implement appropriate technical and organisational measures to protect it.

We do not sell your personal data to third parties.

---

6. International transfers

Some of our service providers or their systems may be located outside the UK or may transfer data outside the UK. Where this happens and the destination country is not subject to a UK “adequacy decision”, we will ensure that appropriate safeguards are in place, such as:

• standard contractual clauses approved by the UK government; or

• other safeguards permitted under UK data protection law.

You can contact us for further information about international transfers relating to your personal data.

---

7. How long we keep your data

We keep personal data only for as long as necessary for the purposes described in this Privacy Policy, including to:

• meet our contractual obligations;

• comply with legal and regulatory requirements;

• resolve disputes;

• establish, exercise or defend legal claims.

Retention periods vary depending on the type of data and legal requirements, but typically:

• Resident care records – kept for at least the period specified by health and social care regulations and best-practice guidance.

• Financial and transactional records – typically kept for 6–7 years for tax and accounting purposes.

• Recruitment records for unsuccessful candidates – usually kept for up to 6–12 months, unless you agree to a longer period.

• Employment records – retained in line with employment law and regulatory requirements.

• Website logs and analytics data – retained for a limited period for security, troubleshooting and reporting, as appropriate.

When data is no longer required, it will be securely deleted, anonymised or archived in line with our retention policies and legal requirements.

---

8. Cookies and similar technologies

We use cookies and similar technologies on our websites to:

• make them work correctly and securely;

• remember your preferences and settings (including accessibility preferences);

• understand how they are used and improve our content and services;

• where enabled, measure the effectiveness of our information and marketing (for example with Google Analytics).

Where required by PECR, we will ask for your consent before setting non-essential cookies, such as analytics cookies. You can manage your cookie preferences at any time via our cookie banner or the “Cookie Settings / Change cookie settings” link on our websites.

For more detail, including the types of cookies we use and how long they last, please see our separate Cookie Policy.

---

9. Your rights

Under UK data protection law, you have a number of rights in relation to your personal data, subject to certain conditions and exemptions. These include:

• Right to be informed – the right to receive clear information about how we use your data (this Privacy Policy is part of that).

• Right of access – the right to request a copy of the personal data we hold about you.

• Right to rectification – the right to ask us to correct inaccurate or incomplete data.

• Right to erasure – in some circumstances, the right to ask us to delete your data (“right to be forgotten”).

• Right to restrict processing – in certain situations, the right to ask us to restrict how we use your data.

• Right to data portability – in some cases, the right to receive your data in a structured, commonly used format and/or have it transferred to another controller.

• Right to object – the right to object to certain types of processing, including direct marketing and processing based on our legitimate interests.

• Rights in relation to automated decision-making and profiling – where applicable.

If you would like to exercise any of these rights, please contact us using the details in section 1. We may need to verify your identity and ask for further information to help us locate the data.

If your request relates to someone else’s data and you are acting on their behalf (for example, as a parent, carer or attorney), we may request evidence of your authority.

---

10. Marketing communications

We may use your contact details to send you information about:

• our homes and care services;

• open days, events and initiatives;

• news and updates about South West Care Homes.

We will only send you such communications where this is lawful (for example, where you have given consent or where we are otherwise permitted under PECR) and in line with your preferences.

You can opt out of marketing communications at any time by:

• clicking the “unsubscribe” link in our emails; or

• contacting us using the details in section 1.

Even if you opt out of marketing, we may still need to send you essential non-marketing communications, for example about care arrangements, billing or important changes to our services.

---

11. Security

We take the security of your personal data seriously. We use appropriate technical and organisational measures designed to:

• protect against unauthorised or unlawful access, alteration, disclosure or destruction; and

• protect against accidental loss or damage.

These measures include (where appropriate):

• access controls, permissions and authentication;

• secure servers and encryption;

• regular updates and security patching;

• staff training and confidentiality obligations;

• incident response and data breach reporting procedures.

However, no system can be completely secure. If you have concerns about the security of your data or suspect a security issue, please contact us immediately.

---

12. Children’s data

Our care homes primarily support adults, but we may occasionally process limited personal data relating to children, for example where they are family members, visitors or legal representatives’ dependants.

We handle any such data with particular care and in line with relevant legal requirements and guidance.

---

13. Third-party websites

Our websites may contain links to third-party websites or services, such as recruitment portals, social media platforms, map services or other information sites. If you follow these links, please note that these websites have their own privacy and cookie policies.

We are not responsible for the content or practices of third-party websites and we encourage you to review their policies before providing any personal data.

---

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example to:

• reflect changes in how we process personal data;

• address changes in law or regulatory guidance;

• improve clarity and transparency.

The “Last updated” date at the top of this page shows when this Privacy Policy was last revised. We recommend checking this page periodically to stay informed about how we use your data.

Where appropriate, we may notify you of significant changes in other ways (for example by email or website notice).

---

15. Contact and complaints

If you have any questions about this Privacy Policy or how we handle your personal data, or if you would like to exercise your rights, please contact:

South West Care Homes Ltd
Tamar Science Park, 1 Davy Road, Plymouth PL6 8BX
Email: info@southwestcarehomes.co.uk
Telephone: 0800 324 7007

If you are not satisfied with our response, you also have the right to lodge a complaint with the UK’s data protection regulator:

Information Commissioner’s Office (ICO)
ico.org.uk | 0303 123 1113

We would, however, appreciate the chance to address your concerns before you approach the ICO, so please contact us in the first instance where possible.